@payez/next-mvp 4.1.14 → 4.1.21

package/dist/auth/better-auth.js

@@ -51,6 +51,7 @@ exports.configureBetterAuth = configureBetterAuth;
 exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
+exports.storeIdpTokensInSession = storeIdpTokensInSession;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -62,6 +63,7 @@ const magic_link_1 = require("better-auth/plugins/magic-link");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
+const session_store_1 = require("../lib/session-store");
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -210,16 +212,24 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
         // Redis-backed session storage via secondaryStorage
         secondaryStorage: {
             get: async (key) => {
-                return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
+                try {
+                    return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
+                }
+                catch {
+                    return null;
+                }
             },
             set: async (key, value, ttl) => {
-                const redis = (0, redis_1.getRedis)();
-                if (ttl) {
-                    await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
-                }
-                else {
-                    await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+                try {
+                    const redis = (0, redis_1.getRedis)();
+                    if (ttl) {
+                        await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+                    }
+                    else {
+                        await redis.setex(`ba:${appSlug}:${key}`, session_store_1.SESSION_TTL, value);
+                    }
                 }
+                catch { /* Redis unavailable — cookie cache still works */ }
             },
             delete: async (key) => {
                 try {
@@ -264,6 +274,9 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
         plugins: [
             (0, next_js_1.nextCookies)(),
             ...(opts.magicLink ? [(0, magic_link_1.magicLink)(opts.magicLink)] : []),
+            // App-supplied plugins last: they may depend on the built-ins above, and
+            // ordering is BA's own concern once they are in the array.
+            ...(opts.plugins ?? []),
         ],
     });
 }
@@ -427,8 +440,20 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             return false;
         }
         // Build IDP token data
-        // CRITICAL: If the IDP withholds refresh_token without setting requiresTwoFactor,
-        // treat missing refresh token as "2FA required" so middleware redirects to verify-code.
+        // ORIGINAL INTENT: IDP withholds refresh_token until 2FA is complete, so
+        // !hasRefreshToken was a reliable "2FA required" signal.
+        //
+        // BUG [IDP-2FA-BUG]: IDP is currently returning refresh_token on the initial
+        // oauth-callback even for require_2fa tenants that haven't done 2FA yet.
+        // This made !hasRefreshToken=false → requiresTwoFactor=false → mfaVerified=true,
+        // bypassing the 2FA gate entirely.
+        //
+        // FIX: Always set mfaVerified=false on the initial OAuth exchange.
+        // The tenant's require_2fa setting is enforced by the viability endpoint
+        // (tenantRequiresTwoFactor=true), which redirects to verify-code whenever
+        // mfaVerified=false. After real 2FA, transitionTo2FASession() sets it true.
+        // Revert this comment + restore `mfaVerified: !requiresTwoFactor` once the
+        // IDP correctly withholds refresh_token until post-2FA.
         const hasRefreshToken = !!result.refresh_token;
         const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? !hasRefreshToken;
         const idpTokenData = {
@@ -442,31 +467,125 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             name: result.user?.full_name || result.user?.name || result.name || name,
             image: image,
             roles: result.user?.roles || result.roles || [],
-            mfaVerified: !requiresTwoFactor,
+            mfaVerified: false, // Always false post-OAuth — see IDP-2FA-BUG note above
+            // Cards 141688/141741 — RELAYED, NOT DERIVED.
+            //
+            // The IDP already decides this (ExternalAuthController:943 and :2024,
+            // WO 113023): "enroll_mfa" = no CONFIRMED method, "mfa_verify" = a
+            // confirmed method exists, null = fully authenticated. It was emitted
+            // here and dropped on this line — `idpTokenData` is built field-by-field,
+            // so anything not named is silently discarded. Both downstream consumers
+            // (the middleware gate and the verify-code page) then reasoned in its
+            // absence and sent zero-method users to a page they cannot act on.
+            //
+            // WIRE NAME IS SNAKE: `next_step`, per [JsonPropertyName("next_step")] on
+            // BOTH OAuthCallbackResponse and ExternalTokenResponse. Reading
+            // `result.nextStep` here would be `undefined` forever and fail silently —
+            // the same camel/snake break `requires_two_factor` already cost us once.
+            //
+            // Do NOT recompute this from a method query. The IDP owns the fact; it is
+            // already usable-aware (confirmed and not revoked, per DotNetPert), which
+            // is the distinction that decides correctness: a revoked-TOTP user has
+            // count>0 but usable=0, and deriving it locally would let through exactly
+            // the users we must challenge.
+            // No `?? null`: if the response has no `next_step` at all (older IDP
+            // build, or a path that does not set it), that is UNKNOWN, not "fully
+            // authenticated". Defaulting it to null here would manufacture a
+            // clean-bill-of-health the IDP never gave and fail open at the gate.
+            nextStep: result.next_step,
             idpClientId: result.client_id ? String(result.client_id) : undefined,
             merchantId: result.merchant_id ? String(result.merchant_id) : undefined,
         };
-        // Store in BA Redis session (for decodeSession)
+        // Storage is shared with the passkey sign-in path — see storeIdpTokensInSession.
+        const stored = await storeIdpTokensInSession(sessionToken, idpTokenData, provider);
+        if (stored)
+            console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+        return stored;
+    }
+    catch (err) {
+        console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+        return false;
+    }
+}
+/**
+ * Write IDP tokens into an EXISTING Better Auth session. Storage only — this
+ * function never acquires tokens and never decides who the caller is.
+ *
+ * ── WHY THIS IS SPLIT OUT (BAPert ruling, 2026-08-04) ────────────────────────
+ *
+ * `exchangeOAuthForIdpTokens` above does TWO things: it ACQUIRES tokens by
+ * POSTing to `/api/ExternalAuth/oauth-callback`, and then it STORES them. Only
+ * the second half is reusable, and the first half is actively dangerous to
+ * reuse:
+ *
+ *   oauth-callback mints an IDP bearer from an ASSERTED EMAIL with no
+ *   cryptographic verification of any kind (card 138635).
+ *
+ * Passkey sign-in already holds something strictly better — a grant issued by
+ * `/api/ExternalAuth/passwordless/passkey/verify`, which checked a real
+ * signature against a registered credential. Routing that through
+ * oauth-callback to obtain a session would DOWNGRADE a cryptographically
+ * verified assertion into an unverified one, make passkey sign-in weaker than
+ * its own ceremony, and inherit 138635 wholesale.
+ *
+ * That is not hypothetical: "do what the OAuth path does" is the obvious
+ * implementation and it is the wrong one. Splitting acquisition from storage is
+ * what makes the wrong one hard to write by accident.
+ *
+ * ── WHAT CALLERS MUST HAVE DONE FIRST ───────────────────────────────────────
+ *
+ * A Better Auth session must ALREADY EXIST for `sessionToken`. This function
+ * enriches; it does not create. Better Auth owns session creation and cookie
+ * signing, and nothing in this package should replicate either — the cookie is
+ * `{token}.{base64(hmac)}` with standard padding, signed with the runtime
+ * `authSecret` from Redis, and hand-rolling that produces a session which
+ * decodes but does not authenticate.
+ *
+ * @param sessionToken  the Better Auth session token (from its Set-Cookie)
+ * @param idpTokenData  tokens + identity, already obtained by the CALLER'S OWN
+ *                      verified route. Built field-by-field by the caller so an
+ *                      unnamed field cannot ride along silently.
+ * @param authProvider  provenance label recorded on the canonical row. Written
+ *                      to the historical `oauthProvider` key, which predates
+ *                      non-OAuth callers; the NAME is legacy, the VALUE should
+ *                      state what actually authenticated ('passkey', 'google').
+ */
+async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider) {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        const appSlug = config.clientSlug || (0, app_slug_1.getAppSlug)();
+        const baKey = `ba:${appSlug}:${sessionToken}`;
+        const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
+        if (!baRaw) {
+            // No session to enrich. Do NOT create one as a fallback: a session
+            // conjured here would carry no Better Auth cookie, so it would be
+            // unreachable by the browser and invisible to every other consumer —
+            // failing as "silently signed out" rather than as an error.
+            console.warn('[BETTER_AUTH] storeIdpTokensInSession: no BA session for token', sessionToken.substring(0, 10));
+            return false;
+        }
+        const baData = JSON.parse(baRaw);
         baData.idpTokens = idpTokenData;
-        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
-        // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
-        // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
+        await (0, redis_1.getRedis)().setex(baKey, session_store_1.SESSION_TTL, JSON.stringify(baData));
+        // Canonical store — the key getSession() reads, used by the refresh handler
+        // and token lifecycle. A failure here leaves the BA session correct and the
+        // canonical row missing, so it is warned and not fatal: the user is signed
+        // in, and refresh degrades rather than the sign-in failing outright.
         try {
             const { getSessionPrefix } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
             const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-            await (0, redis_1.getRedis)().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
+            await (0, redis_1.getRedis)().setex(canonicalKey, session_store_1.SESSION_TTL, JSON.stringify({
                 ...idpTokenData,
-                oauthProvider: provider,
+                oauthProvider: authProvider,
             }));
         }
         catch (canonicalErr) {
             console.warn('[BETTER_AUTH] Failed to write canonical session:', canonicalErr instanceof Error ? canonicalErr.message : String(canonicalErr));
         }
-        console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
         return true;
     }
     catch (err) {
-        console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+        console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', err instanceof Error ? err.message : String(err));
         return false;
     }
 }

package/dist/auth/utils/idp-client.d.ts

@@ -11,7 +11,7 @@
  * @version 1.0.0
  * @since auth-refactor-2026-01
  */
-import type { IdpLoginResponse, IdpOAuthCallbackResponse, IdpRefreshResponse, LoginCredentials } from '../types/auth-types';
+import type { IdpLoginResponse, IdpRefreshResponse, LoginCredentials } from '../types/auth-types';
 /**
  * Get IDP base URL. Throws if not configured.
  */
@@ -32,30 +32,21 @@ export declare function idpLogin(credentials: LoginCredentials, clientHeaders?:
     userAgent?: string;
 }): Promise<IdpLoginResponse>;
 /**
- * Register/authenticate OAuth user with IDP.
+ * idpOAuthCallback REMOVED 2026-08-05 (NextPert, BAPert 20168 / QAPert 20166).
  *
- * Called after OAuth provider (Google, etc.) redirects back.
- * Creates or retrieves IDP user and returns IDP tokens.
+ * It POSTed to /api/ExternalAuth/oauth-callback with provider, email, name,
+ * tokens and client_id — ALL ASSERTIONS, no id_token, nothing verifiable. After
+ * the 170003 fix (13436d56e) that call can only ever return 401.
  *
- * @param oauthData - Data from OAuth provider
- * @returns IDP response with tokens and user info
- */
-export declare function idpOAuthCallback(oauthData: {
-    provider: string;
-    providerAccountId: string;
-    email: string;
-    name?: string;
-    image?: string;
-    accessToken?: string;
-    refreshToken?: string;
-    expiresAt?: number;
-}): Promise<IdpOAuthCallbackResponse>;
-/**
- * Refresh an expired access token using the refresh token.
+ * It was a SECOND caller of the same endpoint, and only the first
+ * (better-auth.ts, card 138635) was hardened — the same duplicated-integration
+ * trap the viability code documents ("adding the relay to just one would leave
+ * an app that mounts THIS one still blind").
  *
- * @param refreshToken - The refresh token from previous login
- * @param mfaContext - MFA context to preserve across refresh
- * @returns New tokens or error
+ * It had no call sites and was not reachable through the package exports map
+ * (no ./auth/utils key, no wildcard), so removing it breaks nothing. Deleted
+ * rather than fixed, because an unreachable function whose only outcome is a
+ * 401 that LOOKS like a security success is a trap for whoever finds it next.
  */
 export declare function idpRefreshToken(refreshToken: string, mfaContext?: {
     amr?: string[];

package/dist/auth/utils/idp-client.js

@@ -16,7 +16,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIdpUrl = getIdpUrl;
 exports.getClientId = getClientId;
 exports.idpLogin = idpLogin;
-exports.idpOAuthCallback = idpOAuthCallback;
 exports.idpRefreshToken = idpRefreshToken;
 exports.idpVerify2FA = idpVerify2FA;
 exports.idpSend2FACode = idpSend2FACode;
@@ -133,90 +132,21 @@ function getLoginErrorMessage(status, responseData) {
 // OAUTH CALLBACK
 // ============================================================================
 /**
- * Register/authenticate OAuth user with IDP.
+ * idpOAuthCallback REMOVED 2026-08-05 (NextPert, BAPert 20168 / QAPert 20166).
  *
- * Called after OAuth provider (Google, etc.) redirects back.
- * Creates or retrieves IDP user and returns IDP tokens.
+ * It POSTed to /api/ExternalAuth/oauth-callback with provider, email, name,
+ * tokens and client_id — ALL ASSERTIONS, no id_token, nothing verifiable. After
+ * the 170003 fix (13436d56e) that call can only ever return 401.
  *
- * @param oauthData - Data from OAuth provider
- * @returns IDP response with tokens and user info
- */
-async function idpOAuthCallback(oauthData) {
-    const idpUrl = getIdpUrl();
-    const clientId = getClientId();
-    try {
-        const response = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Client-Id': clientId,
-            },
-            body: JSON.stringify({
-                provider: oauthData.provider,
-                provider_account_id: oauthData.providerAccountId,
-                email: oauthData.email,
-                name: oauthData.name || '',
-                image: oauthData.image || '',
-                access_token: oauthData.accessToken || '',
-                refresh_token: oauthData.refreshToken || '',
-                expires_at: oauthData.expiresAt || 0,
-                client_id: clientId,
-            }),
-        });
-        if (!response.ok) {
-            const errorText = await response.text().catch(() => 'Unknown error');
-            console.error('[IDP_CLIENT] OAuth callback failed:', response.status, errorText);
-            return {
-                success: false,
-                error: {
-                    code: `HTTP_${response.status}`,
-                    message: 'OAuth registration failed',
-                },
-            };
-        }
-        const data = await response.json();
-        const responseData = data.data || data;
-        // Normalize snake_case to camelCase
-        return {
-            success: responseData.success !== false,
-            data: responseData.success !== false
-                ? {
-                    accessToken: responseData.accessToken || responseData.access_token,
-                    refreshToken: responseData.refreshToken || responseData.refresh_token,
-                    isNewUser: responseData.isNewUser ?? responseData.is_new_user ?? false,
-                    user: responseData.user
-                        ? {
-                            userId: responseData.user.userId || responseData.user.user_id,
-                            email: responseData.user.email || responseData.user.Email,
-                            fullName: responseData.user.fullName || responseData.user.full_name || responseData.user.name,
-                            roles: responseData.user.roles || [],
-                        }
-                        : undefined,
-                }
-                : undefined,
-            error: responseData.error,
-        };
-    }
-    catch (error) {
-        console.error('[IDP_CLIENT] OAuth callback request failed:', error);
-        return {
-            success: false,
-            error: {
-                code: 'NETWORK_ERROR',
-                message: 'Failed to connect to authentication service',
-            },
-        };
-    }
-}
-// ============================================================================
-// TOKEN REFRESH
-// ============================================================================
-/**
- * Refresh an expired access token using the refresh token.
+ * It was a SECOND caller of the same endpoint, and only the first
+ * (better-auth.ts, card 138635) was hardened — the same duplicated-integration
+ * trap the viability code documents ("adding the relay to just one would leave
+ * an app that mounts THIS one still blind").
  *
- * @param refreshToken - The refresh token from previous login
- * @param mfaContext - MFA context to preserve across refresh
- * @returns New tokens or error
+ * It had no call sites and was not reachable through the package exports map
+ * (no ./auth/utils key, no wildcard), so removing it breaks nothing. Deleted
+ * rather than fixed, because an unreachable function whose only outcome is a
+ * 401 that LOOKS like a security success is a trap for whoever finds it next.
  */
 async function idpRefreshToken(refreshToken, mfaContext) {
     const idpUrl = getIdpUrl();